CVE-2026-115243: WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPvivid — Backup, Migration & Staging WordPress pluginto a version that resolves this vulnerability.Fixed in 0.9.137
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress administrator is required. The issue is therefore most relevant where administrator accounts may be compromised, shared, or granted to untrusted users.
Which plugin versions are affected?
WPvivid Backup & Migration versions 0.9.117 through 0.9.136 are affected. Version 0.9.137 is not described as affected.
What does successful exploitation allow?
An administrator can upload and store a file with an arbitrary extension, including PHP, in the plugin's import directory. The supplied data does not state whether uploaded PHP files will be executed in every deployment.
What is the immediate mitigation if updating is not possible?
The provided data identifies administrator authentication as a requirement, so restrict administrator access to trusted accounts and protect those accounts from compromise. It does not provide a configuration-based workaround.